nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
authorJordy Zomer <jordy@pwning.systems>
Tue, 11 Jan 2022 16:44:51 +0000 (17:44 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 28 Mar 2022 07:59:53 +0000 (09:59 +0200)
commit0646efbb6e100a3f93eba3b6a10a7f4c28dd1478
treef604b96829e5fe222b8bc5a3e66f1bf0ac0858f9
parent4d1b0ace2d56dc27cc4921eda7fae57f77f03eb5
nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION

commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 upstream.

It appears that there are some buffer overflows in EVT_TRANSACTION.
This happens because the length parameters that are passed to memcpy
come directly from skb->data and are not guarded in any way.

Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Denis Efremov <denis.e.efremov@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/nfc/st21nfca/se.c